Timer unit, system, computer program product and method for testing a logic circuit

ABSTRACT

A timer unit includes a timer for timing the period of time the logic circuit has been in the self-test mode. A comparator is connected to the timer, for comparing the period of time with a maximum for the period of time the logic circuit is allowed to be in the self-test mode and outputting an error signal when the period of time exceeds the maximum. The test timer unit further includes a mode detector for detecting a switching of the logic circuit to the self-test mode. The mode detector is connected to the timer, for starting the timer upon the switching to the self-test mode and stopping the timer upon a switching of the logic circuit out of the self-test mode. The timer unit can be used in a system for testing a logic circuit which includes a test routine module containing a set of instructions which forms a test routine for performing a test on a tested part of the logic circuit. The system has a mode control unit containing a set of instructions which is executable by the logic circuit, for switching the logic circuit from and to a test mode in which a part of the logic circuit can be subjected to a selected test by executing a selected test routine.

FIELD OF THE INVENTION

This invention relates to timer unit, to a system for testing a logiccircuit, to an assembly, to an apparatus including a system for testinga logic circuit, to a computer program product and to a method fortesting a logic circuit.

BACKGROUND OF THE INVENTION

Systems for testing logic circuits are known in the field of dataprocessing. For example, it is known to test digital processors with socalled ‘self-test software’ for digital processors used for safetyrelevant applications or other applications which require a highreliability or operational availability, such as chassis control orpower train control in vehicles. The self-test software is typicallyembedded in the application run by the digital processor and consists ofa set of test routines, and an interfacing program between the testroutines and the user application. Each test routine represents a pieceof code which is designed to perform a test on a part of the logiccircuit in order to detect physical defects. The test routine reports aresult of the test to the interfacing program. The interfacing programdetermines an overall result from the test results reported by theindividual test routines.

Self-test software is often used in safety relevant applications, suchas control of cars or airplanes, and it is often required that self-testsoftware meets the safety requirements. The self test software mayswitch parts of the system to specific modes or change the system tospecific states particularly suitable for testing. As the self-testsoftware should test those system parts that are used for theapplication there is a potential for negative interference of the selftest software with the application if the self test software isactivated incorrectly, for example outside a specific test window in theapplication schedule. Systems are known in which a so called ‘watch-dogtimer’ is provided. The watch-dog timer is activated by the applicationat the beginning of running the self-test test software and measures theperiod of time the self-test is taking. The watch-dog timer compares themeasured period with a threshold. When the measured period exceeds thethreshold, the watch-dog timer outputs a warning.

However, a disadvantage of the known systems is that there is a riskthat (a part of) the self-testing is performed without activating thewatch-dog timer. For example, without being noticed as an error, theself-test software may be activated without starting the watchdog timerdue to a fault in the application run by the digital processor. Also,the self-test software may not be entered at the correct address,causing the watchdog timer not being activated. Another situation inwhich the watchdog timer may be unintentionally not activated is whenthe system enters unintended a specific test mode due to a fault.

SUMMARY OF THE INVENTION

The present invention provides a timer unit, a system, an assembly, anapparatus, computer program products and a method as described in theaccompanying claims.

Specific embodiments of the invention are set forth in the dependentclaims.

These and other aspects of the invention will be apparent from andelucidated with reference to the embodiments described hereinafter.

BRIEF DESCRIPTION OF THE DRAWINGS

Further details, aspects and embodiments of the invention will bedescribed, by way of example only, with reference to the drawings.

FIG. 1 shows an example of an embodiment of an apparatus in which asystem for testing a logic circuit may be used.

FIG. 2A shows a block diagram of hierarchical representation of a firstexample of an embodiment of a system for testing a logic circuit andFIG. 2B shows a block diagram of a hardware representation of the firstexample.

FIG. 3 shows a block diagram of a test timer unit suitable for theexample of FIG. 2.

FIG. 4 shows a block diagram of a hardware representation of an exampleof an embodiment of an assembly with a system for testing a logiccircuit in accordance with an embodiment of the invention.

FIG. 5 shows an example of a flow-chart of a method for testing a logiccircuit.

DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

Referring to FIG. 1, an example of an apparatus is shown therein. Theexample shown in FIG. 1, is a motorized vehicle, and more in particularis a car 1. The car 1 may include an assembly 2 of a logic circuit 20and a test system 25. (For sake of simplicity the test system 25 is notshown in FIG. 1.).

The logic circuit 20 may, as is explained below in more detail, forexample execute a data processing application (APP) 24. The dataprocessing application may for instance be a control application forcontrolling the operation of a physical device and for instance controla part of the vehicle, such as for example an electronic stabilitycontrol application. However, the data processing application may alsobe another type of application, and for example be an application whichcontrols a medical system such as a patient monitoring system, asecurity application, for example an application which controlsfinancial transactions or encrypts data or any other type of applicationthat requires the logic circuit on which the application is running tobe tested.

The data processing application 24 may, for instance, control actuators22 to correct the movement of the car 1. The data processing application24 may, for example, control individual brakes acting on the frontwheels 11 or the rear wheels 12 and/or control the power of an engine13, in order to correct, for example, under-steer or over-steer of thecar 1. The data processing application 24 may further control theactuators 22 based on the information provided by sensor 21, for examplein order to prevent the car 1 from slipping or otherwise correct themovement of the car 1.

The logic circuit 20 may for example be connected to sensors 21 andactuators 22. The assembly 2 may, as shown in the example of FIG. 1,include a bus 23 which connects the sensors 21 and actuators 22 to thelogic circuit 20. For instance, the logic circuit 20 may receive fromthe sensors 21 signals representing information about, for example, theacceleration and/or rotation of the car 1. The logic circuit 20 may forinstance receive from the sensors 21 information about a driversintended direction in steering and braking inputs given by the driver,for instance by sensing movement of a steering wheel or a brakingpaddle, and/or information about to the vehicle's response, for examplein terms of the lateral acceleration, rotation and individual wheelspeeds. The data processing application 24 may use the information fromthe sensors 21 to control the actuators 22 and hence, for example,provide an electronic stability control (ESC) to the vehicle.

Referring to FIGS. 2A and 2B, the assembly 2 may include a test system25. The test system 25 may be arranged to test the logic circuit 20. Thetest system 25 may for instance include a mode control unit (MC) 26, oneor more test routine modules 27 and a timer unit 28. It will be apparentthat the timer unit 28 may be used in other types of assemblies, and forexample be connected to a logic circuit 20 to determine the period oftime of other processes on the logic circuit 20 such as other types oftests, the processing of interrupts, idle time processes or othersuitable types of processes.

The test routine modules 27 may each contain a set of instructions. Theset may form a test routine TR₁ . . . TR_(N) for performing a test on atested part 277 of the logic circuit 20. The set of instructions may forexample form a self-test routine, for example stored in a memory, whichis executable by one or more self-testing parts 277 of the logic circuit(20). However the test routine module 27 may be implemented in adifferent manner, and for example be implemented as a applicationspecific integrated circuit (ASIC) which can execute the test-routine orother suitable type of programmable or non-programmable hardware.

The mode control unit 26 may contain a set of instructions for switchingthe logic circuit from and to a self-test mode in which one or moreparts of the logic circuit 20 can execute one or more selected testroutines TR₁ . . . TR_(N), and hence subject the parts 277 to one ormore selected self tests. The logic circuit 20 may function differentlyin the self-test mode than in other modes in a way that is particularlysuitable for testing the logic circuit 20. For example, in the self-testmode certain parts of the logic circuit 20 may be blocked or be switchedoff. The instructions may for example be executable by the logic circuit20, in which case the mode control unit 26 may include a memoryconnectable to the logic circuit 20. However, the instructions may alsobe executable by another device, in which case, for example, the modecontrol unit 26 may be implemented as a programmable circuit, such as ageneral purpose processor or non-programmable circuit, such as an ASICconfigured to execute the instructions and which is separate from thelogic circuit 20. For example the mode control unit may cause the logiccircuit 20 to change internal states which are not directly accessibleexcept in a dedicated self test mode. The resulting state of logiccircuit 20 may be such that it cannot be reached by the applicationsoftware or that the application software would cause a system failurewhen operating out of this state. For example, the mode control unit 26may cause the logic circuit to safe or restore its internal state to orfrom memory in order not to cause the application to cause a systemfailure. For example, the mode control unit 26 may cause the logiccircuit to store data into memory, for example information about thestate of the application 24 being executed when the logic circuit 20 isswitched to the self-test mode.

As illustrated in FIG. 2A, the data processing application 24 may forexample be connected to the mode control unit 26. In the example, thedata processing application 24 is connected with an interface 240 to acontrol interface 260 of the mode control unit 26. The data processingapplication 24 may control the mode control unit 26 via the connection,and for example activate the mode control unit 26 to switch the logiccircuit 20 from a normal mode to a self-test mode or vice versa.

The test timer unit 28 may, as shown in FIG. 2B, be connected to thelogic circuit 20 and time the period of time the logic circuit 20 is inthe self-test mode or another type of non-normal mode. Although in thefollowing an example is described of an application in which the timerunit 28 can measure the period of time the logic circuit 20 is in aself-test mode, it will be apparent that the timer unit 28 may measurethe period of time the logic circuit 20 is in another type of non-normalmode such as one of more of: another type of test mode (such as aproduction test mode in which the logic circuit 20 is tested by anexternal device), an interrupt mode, an idle mode or a low power mode.Thus, in the below instead of the self-test mode, a non-normal mode, atest mode, an interrupt mode, an idle mode and/or a low power mode maybe used instead. As illustrated in FIG. 3 in more detail, the test timerunit 28 may for example include a timer 281 and/or a comparator 282and/or a mode detector 283.

The timer 281 may measure the period of time the logic circuit has beenin the self-test mode. The comparator 283 may be connected to the timer281. The comparator 283 may compare the period of time measured by thetimer 281 with a time-out value Tmax corresponding to the maximum forthe period of time the logic circuit is allowed to be in the self-testmode. The comparator 283 may output an error signal when the timer 281times out or expires, that is when the period of time exceeds themaximum. Thereby, it may be prevented that the self-test leads to arunaway of the logic circuit 20 and hence to a undesired or evendangerous system state, and accordingly the reliability of theself-testing and the safety of the system may be improved.

The mode detector 283 may be able to detect a switching of the logiccircuit to the self-test mode and start the timer 281 upon a detectionof a switching to the self-test mode and stop the timer upon a switchingof the logic circuit out of the self-test mode. Thereby, the measurementof the period of time the self-test is or has been taking may beindependent from the operation of the application. Hence, when theself-test mode is entered by accident, this is likely to be detected bythe test timer unit 28, because the timer 281 will be started upondetection of entry of the self-test mode, and the period of timemeasured by the timer 281 will exceed the maximum, resulting inoutputting the error signal. Furthermore, the behaviour of the testtimer unit 28 can be verified for correctness by switching the logiccircuit into the self-test mode and determining whether the timer 281 isstarted and the error signal is outputted by the comparator when thetimer 281 times out.

The timer 281 may be implemented in any manner suitable to measure theperiod of time. As shown in FIG. 3, the timer 281 may for example have acontrol input 2810 via which the timer 281 can be stopped or started.The timer 281 may for example receive a start signal in response of anentry in the self-test mode and receive a stop signal when the logiccircuit 20 exits the self-test mode, for example from the mode detector283. The timer 281 may, in response to the start signal, start measuringthe time. The timer 281 may stop the measurement in response to the stopsignal. The timer 281 may further include an output 2811. The timer 281may present at the output 2811 information about a current timeindicated by the timer.

It will be apparent that the timer may start measuring the time with atimer offset, for example when the timer 281 has been paused (e.g. inresponse to the stop signal) without being reset. The timer 281 may forexample count the number of clock cycles passed since the timer startsignal has been received and adjust an initial value which the counterhad at the time the timer start signal has been received with thecounted number. The timer 281 may output this adjusted value to thecomparator 283.

The timer 281 may include a control input 2811 via which the timeindicated by the timer 281 may be set. The timer 281 may allow settingthe time only when logic circuit 20 is not in self-test mode, so that afaulty execution in self-test mode cannot falsify the time periodmeasurement. Also, the timer 281 may be inhibited from being changedduring the self-test mode by any other means than the automaticdecrementing or incrementing of the timer 281 due to the measurement ofthe period of time. For example, the timer 281 may be reset by the dataprocessing application before the data processing application initiatesa self-test of the logic circuit 20. The timer 281 may also be set inresponse to a detected exit out of the self-test mode by the logiccircuit 20.

For example, as shown in FIG. 3, the test timer unit 28 may include atimer controller 285. The timer controller 285 may be connected to themode detector 283 and the timer 281. In FIG. 3, an input 2850 of thetimer controller 285 is connected to an output 2832 of the mode detector283. An output 2852 of the timer controller 285 is connected in FIG. 3to the control input 2811 of the timer 282. The timer controller 285 mayfor example receive, at the input 2850, a mode exit signal from the modedetector 283 indicating that the mode detector 283 has detected that thelogic circuit 20 exits the self-test mode (and hence when the timer 281is stopped by the mode detector 283). The timer controller 285 may inresponse to the mode exit signal set the value indicated by stoppedtimer 281 to a predetermined value.

The timer value indicated by the stopped timer 281 may for example beset to a value about the same as the time-out value Tmax. Hence, theperiod of time indicated by the stopped timer 281 corresponds to theafore mentioned maximum. The timer controller 285 may also reset thetime-out value Tmax such that the time indicated by the stopped timer281 corresponds to the maximum in another manner, e.g. by setting onlythe time-out value Tmax (to the value indicated by the stopped timer281) or setting the time-out value Tmax and the value indicated by thestopped timer to the same value. Thus, when the logic circuit 20 is notin the self-test mode and by accident enters the self-test mode, thestopped timer 281 will be started but will time-out (almost) immediately(unless of course the timer is reset such that the value indicated bythe timer and the time-out value Tmax are no longer the same). Thereby,an unintended entry into the self-test mode, and hence faulty behaviourof the logic circuit, may be detected quickly.

The timer controller 285 may for example be configured to set, when thelogic circuit is switched to the self-test mode, the timer 281 or thetime-out value Tmax such that the difference Δ(T−Tmax) between the timervalue T and the time-out value Tmax corresponds to the period of timethe logic circuit is allowed to be in the self-test mode. The timecontroller 285 may for example set the timer value T and the time-outvalue Tmax to a respective value which depends on the specific testTR_(i) to be performed, for example, the timer controller 285 mayreceive an indication of the test TR_(i) or the specific values, fromthe data processing application 24 via the input 2851. As shown in FIG.3, for example, the timer controller 285 may have an input 2851 at whicha set signal can be received, for example from the data processingapplication 24 or another source. In response to the set signal, forexample, the timer 281 may be set to an initial value (e.g. to zero incase of an up-timer or to a value corresponding to the maximum in caseof a down timer).

The maximum Tmax for the period of time the logic circuit 20 is allowedto be in the self-test mode may be set to any value suitable for thespecific implementation. The maximum may for example be set to slightlyexceed to the period of time needed to perform the self-test. Forexample, in case the timer counts the number of clock cycles, themaximum may be set to a number of clock cycles slightly exceeding thenumber of clock cycles needed for the self-test. The maximum may forexample be set to a period of a few hundred or a few thousand clockcycles.

The mode detector 283 may be implemented in any manner suitable todetect the mode switching. As for example shown in FIG. 3, a detectorinput 2830 of the mode detector 283 may be connected, via an input 284of the test timer unit 28, to the logic circuit 20, in order to monitora part of the logic circuit 20. For instance, the mode detector 283 maymonitor a register or other part of the logic circuit 20 in which datais stored when the logic circuit 20 is brought into the self-test mode.Also, the mode detector 283 may for example monitor certain locations ina memory in which the logic circuit 20 safes its internal state uponentry of the self-test mode, monitor whether or not parts of the logiccircuit turned off in the mode are switched off. The mode detector mayfor example detect an idle mode by monitoring whether or not the logiccircuit 20 has operations waiting in a queue or not or measure the rateof a clock to determine whether the logic circuit entered the idle mode.

The mode detector 283 may, as shown in FIG. 3, be connected with anoutput 2831 to the control input 2810 of the timer 281. The modedetector 283 may output a timer start signal to the control input 2810when the mode detector 283 detects that the logic circuit 20 enters intothe self-test mode and output a timer stop signal when the mode detector283 detects that the logic circuit 20 exits the self-test mode. Thetimer may be started and stopped in response to the timer start signaland the timer stop signal respectively.

The mode detector 283 may, as shown in FIG. 3, be connected with anoutput 2832 to the input 2850 of the timer controller 285. The modedetector 283 may output, e.g. via the output 2832, a set signal to thetimer controller 285 when the mode detector 283 detects that the logiccircuit 20 exits the self-test mode. In response to the set signal, thetimer controller may, as described above, set the timer and/or time-outvalue Tmax such that the difference between both corresponds to theperiod of time the logic circuit 20 is allowed to be in the self-testmode.

The comparator 283 may be implemented in any manner suitable to comparethe period of time with the time-out value Tmax. As shown in FIG. 3, thecomparator 283 may for instance have an input 2820 which is connected tothe output 2811 of the timer 281. As shown in FIG. 3, the comparator 283may include threshold inputs 2822, 2823 at which one or more thresholdvalues Tmax, Tmin may be presented with which the information receivedfrom the timer 281 is compared. The comparator 282 may for exampleoutput an error signal in case the time indicated by the timer 281exceeds the threshold value Tmax which corresponds to the maximum (incase the timer is an up-timer) or when the time indicated by the timer281 comes below the threshold value Tmax (in case the timer is adown-timer).

The comparator 283 may be configured to compare the period of timeindicated by the stopped timer with a minimum Tmin for the self-testduration, and output an error signal in case the period of timeindicated by the stopped timer is less than the minimum. As illustratedin FIG. 3, the comparator 282 may for example have a threshold valueinput 2823 at which a threshold value Tmin may be presented whichcorresponds to the minimum. The comparator 282 may compare the timereceived at the input 2820 with the threshold value Tmin when the timer281 is stopped. The comparator 282 may for example output an errorsignal in case the time indicated by the stopped timer 281 is below thethreshold value Tmin in case the timer is an up-timer or when the timeindicated by the timer 281 comes exceeds the threshold value Tmin incase the timer is a down-timer.

The test timer unit 28 may be implemented in any manner suitable for thespecific implementation. As shown in FIG. 4, the test timer unit 28 mayfor instance be implemented on a logic circuit separate from the logiccircuit 20 which executed the self-test. As shown in FIG. 2B, the testtimer unit 28 may be connected to the logic circuit 20. The test timerunit 28 may for example be implemented as a separate piece of hardwaredevice and for example be part of a separate microprocessor or amicrocontroller. The microprocessor may for example include a centralprocessing unit (CPU) and/or a coprocessor and/or a digital signalprocessor and/or an embedded processor.

The test timer unit 28 may for example perform an operation asillustrated in FIG. 5. As shown in FIG. 5 with step I, when the logiccircuit is in normal mode (that is not in the self-test mode), the timervalue may be zero (e.g. when the timer is a down-timer and thethreshold-value Tmax is set to zero) and the timer may not be running.When the data processing application initiates a self-test and sets thelogic circuit 20 to the self-test mode, as indicated with step IV, thetimer value T and/or the threshold value Tmax may be set. The values T,Tmax may for example be set to a value, as indicated with step V, suchthat the difference Δ(T−Tmax) between the timer value and/or thethreshold corresponds to the period of time the logic circuit 20 isallowed to be in the self-test mode (for example in terms of the maximumnumber of clock cycles the self-test is allowed to take), for example bya test shell or the data processing application itself. The self-testmode may then be detected, e.g. by the detector 283, as indicated withstep II and the timer started, as indicated with step III, When thetimer times out, as indicated with step VI in which the timer is assumedto be a down-timer, an error may be outputted, as indicated with stepsVII. When the self-test is completed (or the logic circuit 20 exitsself-test mode for another reason), the mode change is detected, asindicated with step VIII and the timer is stopped, as indicated withstep IX. The timer may then be reset to the initial value in step XI,for example to zero. As indicated with step X, when the stopped timerindicates a time shorter than the minimum Tmin, an error signal may beoutputted.

The test routine modules 27 may be implemented in any manner suitable toself-test a part of the logic circuit 20. For instance, as shown in FIG.3, the test routine modules 27 may for example include one or morememory units 31 in which data 275 can be stored, the data representinginstructions executable by the logic circuit 20. Upon activation of therespective test routine TR₁ . . . TR_(N) by the mode control unit 26,the part 277 of the logic circuit 20 may initiate executing theinstructions defined in the memory unit 275. (In FIG. 3, for sake ofclarity, the hierarchical relationship between the test routines TR₁ . .. TR_(N), the mode control MC and the data processing application APPare indicated with the hairlines connecting data 245,265,275)

The self-testing part(s) 277 may for instance, in accordance with thetest routine TR₁ . . . TR_(N), perform a logic tests with the logiccircuit 20. For instance, the self-testing part(s) 277 may perform alogic test by having the self-testing part 277 (which may be a part orthe entire logic circuit) of the logic circuit performing apredetermined type operation, such a binary operation (for example anexclusive OR) or a calculation (for example a square root calculation).For instance, the test routine 27 may input predetermined test data inthe self-tested part 277 of the logic circuit 20, make the self-testingpart(s) 277 of the logic circuit perform a predetermined type of testoperation and monitor the data output by the self-testing part of thelogic circuit 20 after the test operation.

The test routine TR₁ . . . TR_(N) may be any routine suitable for theself-testing parts 277 to detect a faulty behaviour on their sides. Theself-testing part 277 executing a test routine TR₁ . . . TR_(N) may forinstance determine a self-test signature, such as an N-bit number, and,for example, check the correctness of the self-test signature. Theself-testing part 277 executing a test routine TR₁,TR_(N) may forinstance compare the self-test signature with a predetermined signatureto determine whether or not the test routine has detected a fault in thelogic circuit 20. For instance, in case the self-test signature does notcorrespond to a sufficient degree to the predetermined signature, theself-testing part 277 executing a test routine TR₁,TR_(N) may determinethat the test routine has detected a fault in the logic circuit 20, andelse that the test routine has not detected a fault in the logic circuit20. The self-testing part 277 executing a test routine TR₁ . . . TR_(N)may output, for instance to the mode control unit 26 or to the dataprocessing application 24 the determined outcome and/or the self-testsignature. The test routine module 27 may contain a set of instructionsfor example defining an operation which may be described with thefollowing pseudo-code:

start { perform self-test and determine test_signature iftest_signature== predetermined signature  then test_result= correct else test_result= fault output= test_result } end

The self-testing part 277 may determine the self-test signature in anysuitable manner. For example, the part 277 of the logic circuit 20 mayperform, in accordance with the instructions, one or more predeterminedoperations which change the state of (the self testing part 277 of) thelogic circuit 20. The self testing part 277 may for instance determine asignature value which is unique for the sequence of state transitions ofthe logic circuit 20 or for which only a very small chance exists thatanother sequence of state transitions will give the same value. The part277 may then determine the correctness of the determined signaturevalue, for example by comparing the determined signature value with apredetermined signature value. In case the determined signature value isnot correct, this implies that the self-testing part 277 exhibits afaulty behaviour and accordingly that the result of the self-test isthat the self-testing part 277 has failed the self test. Theself-testing part 277 may output the result of the self-test, forexample as data including the self-test signature and the determinedoutcome of the self-test using the interfaces 270,271, to the modecontrol unit 26 and/or other components units or devices, such as thedata processing application 24 or the timer unit 28.

The test routines TR₁ . . . TR_(N) may each include instructions fortesting different parts of the logic circuit 20. As illustrated in FIG.3, for instance one or more of the test routines TR_(A) may, whenexecuted, self-test a first part 277 of the logic circuit 20. One ormore other test routines TR_(B) may, when executed, self-test a secondpart 277 of the logic circuit 20. As shown in FIG. 2B, the test routinesTR₁,TR_(N) may for example test (partially) overlapping parts 277 of thelogic circuit 20. As shown in FIG. 3, the self-testing parts 277 mayhave an overlap with, for example, a part 246 of the logic circuit 20executing a data processing application APP or with a part 266 of thelogic circuit 20 executing the mode control application MC. Furthermore,the parts 277 executing the test routines TR₁,TR_(N) may operateindependently from each other, e.g. by executing the test routinesTR₁,TR_(N) at different points in time and for example use differentresources, with or without any overlap in the parts 277 of the logiccircuit 20 executing the test routine. Thereby, the chance thatintermittent faults, or faults caused by effects which do not cause aphysical defect (e.g. EMC), are detected may be increased, (for examplewhen the areas in the overlaps are tested at different points in time).Furthermore, when the self-testing parts 277 do not overlap completely,an analysis of multiple self-test results enables a more preciselocation of a fault and therefore to determine more accurately itsseverity for the data processing application.

The logic circuit 20 may be implemented in any manner suitable for thespecific implementation. The logic circuit 20 may for instance be aprogrammable device and may be connected to one or more memories 31, inwhich instructions executable by the logic circuit can be stored, forinstance during manufacturing of the logic unit or after manufacturing.The logic circuit 20 may for example be part of a microprocessor. Themicroprocessor may for example include a central processing unit (CPU)and/or a coprocessor and/or a digital signal processor and/or anembedded processor. The logic circuit 20 may also be part of amicrocontroller (μC), such as a controller for an electronic stabilitycontrol (ESC) system used to modulate braking and traction forces of avehicle, such as a car.

As shown in FIG. 3, the logic circuit 2 may for instance include one, ormore, processor cores 30 which can execute the instructions in thememory 31 connected to the processor core. At least a part of theprocessor core may then be tested by a test application. The processorcore may for instance include the logic required to execute program codein the form of machine code. The processor core 30 may for instance atleast include an instruction decoder, an arithmetic unit, an addressgeneration unit, and a load/store unit. The microprocessor may forexample include, in addition to the processor core, inputs/outputs301,302 or other components 32-34, such as and/or communicationinterfaces and/or coprocessors and/or analog-to-digital convertersand/or clocks and reset generation units, voltage regulators, memory(such as for instance flash, EEPROM, RAM), error correction code logicand/or timers or other suitable components.

As shown in FIG. 3, for instance, the data processing application 24,the test routine modules 27 and/or the mode control unit 26 may includea memory 31 connectable to the logic circuit 20 in which memory sets ofdata 245,265,275 representing one or more set of instructions executableby the logic circuit 20 are stored, the set forming for instance thedata processing application, one or more test routines TR₁ . . . TR_(N)and/or the mode control application MC. As shown in FIG. 3, forinstance, in the memory 31 a set 245 forming the data processingapplication APP may be stored. Also, in the memory 31 a set ofinstructions 265 forming the mode control application MC may be storedand/or one or more sets 275 of instructions forming the test routinesTR₁ . . . TR_(N). Parts 246, 266, 277 of logic circuit 20 may executethe instructions and hence operate, respectively as a data processingapplication module, a mode control module or a self-testing part.

The invention may also be implemented in a computer program for runningon a computer system, at least including code portions for performingsteps of a method according to the invention when run on a programmableapparatus, such as a computer system or enabling a programmableapparatus to perform functions of a device or system according to theinvention. Such a computer program may be provided on a data carrier,such as a CD-ROM or diskette, stored with data loadable in a memory of acomputer system, the data representing the computer program. The datacarrier may further be a data connection, such as a telephone cable or awireless connection. The computer program product may for instanceinclude program code portions for executing a test application and/or atest routine and/or a module.

The computer program may include a sequence of instructions designed forexecution on a computer system. A program, or computer program, mayinclude a subroutine, a function, a procedure, an object method, anobject implementation, an executable application, an applet, a servlet,a source code, an object code, a shared library/dynamic load libraryand/or other sequence of instructions designed for execution on acomputer system.

In the foregoing specification, the invention has been described withreference to specific examples of embodiments of the invention. It will,however, be evident that various modifications and changes may be madetherein without departing from the broader spirit and scope of theinvention as set forth in the appended claims. For instance, the memory31 may include any medium suitable to store information, such as forinstance a register, random access memory (RAM), cache memory or anyother medium suitable to store information. The memory may for instancebe a volatile or non-volatile memory.

Also, for example, the test routine output interface may include asoftware output interface and/or a hardware output interface.Furthermore, for instance, the test application may be for exampleexecutable separate from the data processing application or beimplemented as a library or other source of instructions that can beexecuted by the data processing application.

Also, as for example illustrated in FIG. 3, the invention is not limitedto physical devices or units implemented in non-programmable hardwarebut can also be applied in programmable devices or units able to performthe desired device functions by operating in accordance with suitableprogram code. Furthermore, the devices may be physically distributedover a number of apparatuses. For example, the timer unit 28 may beimplemented on a separate microprocessor or other logic deviceconnectable to the logic circuit 2. Also, for example, the mode controlunit 26 and/or the data processing application module 24 and/or thetimer unit 28 may be implemented as devices separate from the logiccircuit 20, for example on separate dies packages in the same package asthe logic circuit 20 or be implemented as separate packages.

Also, devices functionally forming separate devices may be integrated ina single physical device. For example, as e.g. shown in FIG. 3, the testsystem 25 and the logic circuit 20 may be implemented on the samemicroprocessor. E.g., the mode control unit 26 and/or the dataprocessing application module 24 and/or the timer unit 28 may be iimplemented on a single device and for example be part of the logiccircuit 20.

However, other modifications, variations and alternatives are alsopossible. The specifications and drawings are, accordingly, to beregarded in an illustrative rather than in a restrictive sense.

In the claims, any reference signs placed between parentheses shall notbe construed as limiting the claim. The word ‘comprising’ does notexclude the presence of other elements or steps then those listed in aclaim. Furthermore, the words ‘a’ and ‘an’ shall not be construed aslimited to ‘only one’, but instead are used to mean ‘at least one’, anddo not exclude a plurality. The mere fact that certain measures arerecited in mutually different claims does not indicate that acombination of these measures cannot be used to advantage.

The invention claimed is:
 1. A timer unit for measuring a period of timeof an operation of a logic circuit comprising: a timer for measuring theperiod of time said logic circuit has been in a non-normal modedifferent from a normal operation mode; a comparator connected to saidtimer, for comparing said measured period of time with a maximum for theperiod of time said logic circuit is allowed to be in said non-normalmode and outputting an error signal signifying a fault in operation ofthe logic circuit in the non-normal mode when said measured period oftime exceeds said maximum; and a mode detector for detecting a switchingof said logic circuit from a normal operation mode to said non-normalmode, said mode detector being connected to said timer, forautomatically starting said timer upon a detection of a switching ofsaid logic circuit to said non-normal mode and automatically stoppingsaid timer upon a detection of a switching of said logic circuit out ofsaid non-normal mode.
 2. A timer unit as claimed in claim 1, including atimer controller connected to said mode detector and said timer, forresetting the stopped timer or setting said maximum, such that theperiod of time indicated by said stopped timer is the same as, orexceeds, said maximum.
 3. A timer unit as claimed in claim 2, whereinsaid timer controller sets, when said logic circuit is switched to thenon-normal mode, said timer and/or said maximum such that the differencebetween the period of time indicated by said timer and said maximumcorresponds to the period of time said logic circuit is allowed to be insaid non-normal mode.
 4. A timer unit as claimed in claim 2, wherein theresetting the timer or setting the maximum is not permitted in thenon-normal mode.
 5. A timer unit as claimed in claim 2, wherein saidcomparator compares the period of time indicated by the stopped timerwith a minimum for the duration of an operation to be performed in saidnon-normal mode, and outputs an error signal in case the period of timeindicated by the stopped timer is less than the minimum, wherein theminimum and the maximum are two different values.
 6. A timer unit asclaimed in claim 2, implemented as a hardware device connectable to saidlogic circuit.
 7. A timer unit as claimed in claim 2, wherein saidnon-normal mode includes one or more of: a low power mode, interruptmode, idle mode.
 8. A timer unit as claimed in claim 1, wherein saidcomparator compares the period of time indicated by the stopped timerwith a minimum for the duration of an operation to be performed in saidnon-normal mode, and outputs an error signal in case the period of timeindicated by the stopped timer is less than the minimum.
 9. A timer unitas claimed in claim 1, implemented as a hardware device connectable tosaid logic circuit.
 10. A timer unit as claimed in claim 1, wherein saidnon-normal mode includes one or more of: a low power mode, interruptmode, idle mode.
 11. A system for testing a logic circuit, said systemcomprising: at least one test routine module containing a set ofinstructions forming a test routine for performing a test on a testedpart of said logic circuit; a mode control unit containing a set ofinstructions for switching said logic circuit from and to a test mode inwhich at least one part of said logic circuit can be subjected to atleast one selected test by executing at least one selected test routine;and a test timer unit as claimed in claim
 1. 12. A system as claimed inclaim 11, wherein at least one of said test routines is a self-testroutine executable by at least one self-testing part of said logiccircuit.
 13. A system as claimed in claim 12, wherein said logic circuitis part of one or more of the group consisting of: a microprocessor, acentral processing unit, a microcontroller, a digital signal processor.14. A system as claimed in claim 12, wherein said logic circuit isarranged to execute a control application for controlling the operationof at least one actuator.
 15. A system as claimed in claim 11, whereinsaid logic circuit is part of one or more of the group consisting of: amicroprocessor, a central processing unit, a microcontroller, a digitalsignal processor.
 16. A system as claimed in claim 15, wherein saidlogic circuit is a processor core.
 17. A system as claimed in claim 11,wherein said logic circuit is arranged to execute a control applicationfor controlling the operation of at least one actuator.
 18. An assemblyof a logic circuit and a system as claimed in claim
 11. 19. A timer unitas claimed in claim 1, wherein said mode detector is to detect theswitching of said logic circuit to said non-normal mode by monitoringone or more of: a register or other part of the logic circuit in whichdata is stored when the logic circuit is brought into said non-normalmode; locations in a memory in which the logic circuit saves itsinternal state upon entry into said non-normal mode; and whether or notparts of the logic circuit turned off in said non-normal mode areswitched off.
 20. A method for testing at least a part of a logiccircuit, including: switching said logic circuit to a test mode in whichat least one tested part said logic circuit can be subjected to at leastone selected test; performing said at least one selected test by atleast one tested part of said logic circuit; switching said logiccircuit out of said test mode after completion of the at least oneselected test routine; and executing a test timing procedure including:detecting a switching of said logic circuit to said test mode; startinga timer in response to said detecting, for timing the period of timesaid logic circuit has been in said test mode; comparing said period oftime with a maximum for the period of time said logic circuit is allowedto be in said test mode; and outputting an error signal when said periodof time exceeds said maximum; and comparing the period of time indicatedby the stopped timer with a minimum for the duration of an operation tobe performed in said non-normal mode, and outputting an error signal incase the period of time indicated by the stopped timer is less than theminimum.